Defenders gain a clearer picture of a single, well-resourced adversary after GreyNoise documented a campaign that breached at least 49 organizations in 29 countries, compromised 996 Zyxel network devices in 48 countries, and pulled more than 18,500 records from a backend database. The activity, attributed to a Chinese-speaking threat cluster with links to the Red Heron group, shows how one operator can chain exploits across WordPress, network switches, firewalls, AI tooling, and virtualization platforms to reach sensitive government and law-enforcement data.<\/p>\n
The attacker reached high-value entities by exploiting a pair of vulnerabilities in the WordPress Core component, tracked as CVE-2026-63030 and CVE-2026-60137 and collectively known as wp2shell. Public exploits for wp2shell appeared in mid-July 2026, with active exploitation recorded within days. GreyNoise observed the campaign starting at roughly the same time.<\/p>\n
Targets spanned small businesses and government organizations. One intrusion at an unnamed Western government organization stood out for its depth. After gaining initial access, the operator ran a custom wp2shell exploit and performed extensive Windows and security reconnaissance, checking Microsoft Defender, AMSI, available services, listening ports, local accounts, application restrictions, and database configuration.<\/p>\n
Over a 36-minute window, the threat actor tried 17 scripts to bypass AMSI, escalate privileges through token impersonation or theft, create a local administrator, and extract registry data. Credentials for a backend SQL database surfaced during that work. The attacker then used those credentials in a password-spraying attack against an internal SQL server and stole at least 18,566 records. According to GreyNoise, those records contained accounts, plaintext passwords, and personally identifiable information (PII) tied to government and law-enforcement agencies.<\/p>\n
The same actor also breached a Russian state organization in occupied Ukraine, which the researchers described as a red-on-red compromise.<\/p>\n
On August 17, 2026, the threat actor began exploiting a high-severity vulnerability in Zyxel GS1900 Smart Managed Switches, tracked as CVE-2026-7273. The flaw gave the operator a path into 996 devices across 48 countries. From those switches, the attacker extracted device configurations, network information, and hashed root-level credentials.<\/p>\n
WordPress and Zyxel were not the only targets. GreyNoise confirmed attempts against several additional products, each through a known flaw:<\/p>\n
Not every flaw exploited in this campaign has been added to CISA’s Known Exploited Vulnerabilities catalog, a point GreyNoise flagged for defenders.<\/p>\n
GreyNoise attributed the activity through its Global Observation Grid (GOG) sensor network. Scans and attacks traced back to the same IP address and had been recorded since early June 2026. The company also published a set of indicators of compromise covering hashes for backdoors and command-and-control infrastructure tied to the observed activity.<\/p>\n
The campaign gives defenders a concrete checklist. WordPress sites running unpatched Core should be treated as exposed, since wp2shell exploits are public and now actively used. Zyxel GS1900 switches need to be checked against the August 17 exploitation window and reviewed for the configuration data and hashed credentials GreyNoise said the attacker pulled. Organizations using PAN-OS GlobalProtect, FlowiseAI, Gitea, Nuclio, SENAITE LIMS, Proxmox VE, or Ubiquiti UniFi devices should confirm that the CVEs listed above are patched, since several of them are not yet in CISA’s KEV catalog despite active use in this campaign.<\/p>\n
Wp2shell is a pair of flaws in the WordPress Core component, tracked as CVE-2026-63030 and CVE-2026-60137. Public exploits appeared in mid-July 2026 and were followed by active exploitation, including a campaign that breached at least 49 organizations in 29 countries.<\/p>\n
GreyNoise observed 996 Zyxel GS1900 Smart Managed Switches compromised in 48 countries after exploitation of CVE-2026-7273 began on August 17, 2026. Extracted data included device configurations, network information, and hashed root-level credentials.<\/p>\n
GreyNoise attributes the activity to a Chinese-speaking threat actor linked to the Red Heron group, the same cluster tied to exploitation of a critical flaw in the Gitea self-hosted Git service. Activity was recorded from early June 2026 and traced to a single IP address.<\/p>\n